Coverage for scripts / live_release_validation / constants.py: 100.00%

1"""Shared tags, labels, and tuning constants for live validation.""" 

2 

3from __future__ import annotations 

4 

5import copy 

6import uuid 

7from pathlib import Path 

8from typing import Any 

9 

10# Anchored to this module, which lives at the package root, so the directory 

11# stays correct no matter where the consuming module sits in the package. 

12# Resolving it relative to a consumer's own __file__ is what broke the job 

13# actions when _load_manifest moved into checks/ (run retry1-8002d6c80f62); 

14# tests/test_live_release_validation.py::TestManifestPathResolution pins this 

15# to the real directory. 

16_MANIFEST_DIR = Path(__file__).resolve().with_name("manifests") 

17 

18 

19_TERMINAL_QUEUE_STATUSES = {"succeeded", "failed", "cancelled"} 

20 

21 

22_HEALTHY_STACK_STATUSES = {"CREATE_COMPLETE", "UPDATE_COMPLETE"} 

23 

24 

25_RUN_STACK_TAG = "GcoLiveValidationRun" 

26 

27 

28_RUN_JOB_LABEL = "gco.aws/validation-run" 

29 

30 

31_PATH_JOB_LABEL = "gco.aws/validation-path" 

32 

33 

34#: Actions that open the private-endpoint kubectl tunnel and therefore need the 

35#: AWS Session Manager plugin on PATH; preflight refuses to deploy without it 

36#: whenever one of these is selected. 

37_CLUSTER_TUNNEL_ACTIONS = frozenset({"inference", "platform-workloads", "network-posture"}) 

38 

39 

40_CENTRAL_MANAGED_BY_LABEL = "gco.io/managed-by" 

41 

42 

43_CENTRAL_QUEUE_KEY_LABEL = "gco.io/queue-job-key" 

44 

45 

46_CENTRAL_QUEUE_ID_ANNOTATION = "gco.io/queue-job-id" 

47 

48 

49_CENTRAL_ORIGINAL_NAME_ANNOTATION = "gco.io/original-job-name" 

50 

51 

52_EKS_KEY_LOGICAL_ID = "EksSecretsEncryptionKey74AFFE88" 

53 

54 

55_KMS_PENDING_WINDOW_DAYS = 7 

56 

57 

58_LOG_CLEANUP_TOKEN_TAG = "GcoLiveValidationCleanupToken" 

59 

60 

61_LOG_CLEANUP_HELPER_STACK_PREFIX = "LiveValidationLogCleanup" 

62 

63 

64_LOG_CLEANUP_HELPER_RUN_TAG = "LiveValidationHelperRun" 

65 

66 

67_LOG_CLEANUP_HELPER_TOKEN_TAG = "LiveValidationHelperToken" 

68 

69 

70_LOG_CLEANUP_ROLE_RUN_TAG = "LiveValidationCleanupRoleRun" 

71 

72 

73_LOG_CLEANUP_ROLE_TOKEN_TAG = "LiveValidationCleanupRoleToken" 

74 

75 

76_LOG_CLEANUP_ROLE_OUTPUT = "CleanupRoleArn" 

77 

78 

79_LOG_CLEANUP_ROLE_POLICY_NAME = "DeleteTaggedLogGroups" 

80 

81 

82_LOG_CLEANUP_SESSION_SECONDS = 900 

83 

84 

85_LOG_CLEANUP_STACK_POLL_ATTEMPTS = 120 

86 

87 

88_LOG_CLEANUP_STACK_POLL_SECONDS = 5 

89 

90 

91_LOG_GROUP_OBSERVATION_ATTEMPTS = 6 

92 

93 

94_LOG_GROUP_CLEANUP_MAX_PASSES = 3 

95 

96 

97_LOG_GROUP_CHECKPOINT_STABLE_OBSERVATIONS = 2 

98 

99 

100_LOG_GROUP_CLEANUP_STABLE_OBSERVATIONS = 2 

101 

102 

103_LOG_GROUP_ABSENCE_OBSERVATIONS = 3 

104 

105 

106_LOG_GROUP_OBSERVATION_POLL_SECONDS = 1 

107 

108 

109_LOG_GROUP_OBSERVATION_HISTORY_LIMIT = 40 

110 

111 

112_LOG_GROUP_RETRYABLE_OBSERVATION_CODES = frozenset( 

113 { 

114 "InternalFailure", 

115 "InternalServerError", 

116 "OperationAbortedException", 

117 "RequestLimitExceeded", 

118 "ServiceUnavailableException", 

119 "Throttling", 

120 "ThrottlingException", 

121 "TooManyRequestsException", 

122 } 

123) 

124 

125 

126_LOG_GROUP_SOURCE_TYPES = { 

127 "AWS::EKS::Cluster", 

128 "AWS::Lambda::Function", 

129 "AWS::Logs::LogGroup", 

130} 

131 

132 

133_EKS_LOG_GROUP_SUFFIXES = ("application", "dataplane", "host", "performance") 

134 

135 

136# UUID version-5 namespaces. Both are arbitrary constants generated once and 

137# then frozen: their only job is to seed `uuid.uuid5`, which hashes 

138# (namespace, name) into a deterministic UUID. Using a private namespace rather 

139# than hashing the name alone keeps these identifiers from colliding with any 

140# other UUID this project or AWS derives from the same input string. 

141# 

142# Treat both values as immutable. Changing one silently changes every ID derived 

143# from it, which for an in-flight or resumed run means the harness would compute 

144# a different identifier for the same logical thing and lose the trail back to 

145# what it already created. 

146 

147#: Namespace for central-queue Job IDs. ``_central_queue_job_id`` derives the 

148#: DynamoDB queue Job ID as ``uuid5(this, idempotency_key)``, so the same 

149#: idempotency key always produces the same Job ID. That is what makes the 

150#: central-queue submission safely retryable: a resumed run recomputes the 

151#: identical ID, finds its own existing queue record, and reconciles it instead 

152#: of enqueueing a duplicate workload. 

153_CENTRAL_QUEUE_IDEMPOTENCY_NAMESPACE = uuid.UUID("88284d12-1e04-47d5-8871-607a9e4dac09") 

154 

155#: Namespace for the delegated log-cleanup helper's identifiers, used twice: 

156#: ``_log_cleanup_helper_spec`` derives the helper CloudFormation stack and IAM 

157#: role name from ``uuid5(this, "<partition>:<account>:<run_id>:<cleanup_token>")``, 

158#: and the tag-conditioned deleter derives its STS session name from 

159#: ``uuid5(this, run_id)``. Deriving rather than randomizing means a resumed run 

160#: recomputes the exact same helper stack, role, and session names, so it can 

161#: find and delete the helper it created earlier instead of orphaning it — while 

162#: still keeping those names unique per run and account. 

163_LOG_CLEANUP_HELPER_NAMESPACE = uuid.UUID("83af5e0b-f987-4ca6-8bb6-aa174c57096c") 

164 

165 

166class _LogGroupCleanupError(RuntimeError): 

167 """Retain structured cleanup evidence while propagating a failed phase.""" 

168 

169 def __init__(self, message: str, details: dict[str, Any]): 

170 super().__init__(message) 

171 self.details = copy.deepcopy(details)